General
-
Target
flbfu6.msi
-
Size
504KB
-
Sample
230530-3c3c3acd6s
-
MD5
101aefb58c77d2fe5b6a7bc1e13ac9d3
-
SHA1
13cbe917288c2f42925b1773838ce2df0a142385
-
SHA256
a5dd3acf7e57cc25ab353d80584c4cf8e148b3504f498e243c4be48f9fc1f064
-
SHA512
f745fe34b525ffbd04768bde8c22a0180435b0a406c8eb9196a8bd39029f46df2a1d356797d77490236bd07086853a254bc156982c8da349486b5591d660d9f5
-
SSDEEP
6144:nESkw7402pCiyBH6DlIxtWb9jOyHLmsjzcGet8Rghs0O892YptgrGzjkacDO+cDb:zkdiMHHLmKzQ8tfacDO+wVydjv3k
Static task
static1
Behavioral task
behavioral1
Sample
flbfu6.msi
Resource
win7-20230220-en
Malware Config
Extracted
qakbot
404.1320
BB30
1685433861
12.172.173.82:50001
178.175.187.254:443
65.95.141.84:2222
205.237.67.69:995
83.110.223.61:443
193.253.100.236:2222
27.0.48.233:443
102.159.188.125:443
71.38.155.217:443
58.186.75.42:443
76.178.148.107:2222
70.28.50.223:2087
114.143.176.236:443
51.14.29.227:2222
59.28.84.65:443
173.88.135.179:443
103.144.201.56:2078
96.87.28.170:2222
105.186.128.181:995
176.142.207.63:443
151.62.238.176:443
12.172.173.82:32101
122.186.210.254:443
82.125.44.236:2222
84.108.200.161:443
76.16.49.134:443
70.28.50.223:32100
12.172.173.82:465
76.170.252.153:995
184.182.66.109:443
78.92.133.215:443
50.68.204.71:993
186.75.95.6:443
113.11.92.30:443
70.28.50.223:3389
98.145.23.67:443
85.57.212.13:3389
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
69.242.31.249:443
81.101.185.146:443
79.168.224.165:2222
75.143.236.149:443
14.192.241.76:995
86.195.14.72:2222
81.229.117.95:2222
220.240.164.182:443
73.29.92.128:443
12.172.173.82:21
96.56.197.26:2222
75.109.111.89:443
76.86.31.59:443
201.244.108.183:995
68.203.69.96:443
124.122.47.148:443
122.184.143.86:443
92.186.69.229:2222
70.28.50.223:2083
89.129.109.27:2222
147.147.30.126:2222
125.99.76.102:443
88.126.94.4:50000
151.65.167.77:443
86.132.236.117:443
92.154.17.149:2222
223.166.13.95:995
89.36.206.69:995
96.56.197.26:2083
78.18.105.11:443
82.127.153.75:2222
90.78.147.141:2222
82.131.141.209:443
183.87.163.165:443
92.9.45.20:2222
80.6.50.34:443
80.12.88.148:2222
69.133.162.35:443
172.115.17.50:443
95.45.50.93:2222
12.172.173.82:2087
103.140.174.20:2222
24.198.114.130:995
50.68.204.71:443
69.119.123.159:2222
64.121.161.102:443
2.82.8.80:443
184.181.75.148:443
70.112.206.5:443
198.2.51.242:993
2.36.64.159:2078
79.77.142.22:2222
84.215.202.8:443
147.219.4.194:443
116.74.164.81:443
70.28.50.223:2078
12.172.173.82:995
77.86.98.236:443
104.35.24.154:443
213.64.33.61:2222
47.149.134.231:443
72.134.124.16:443
47.34.30.133:443
103.42.86.42:995
174.4.89.3:443
161.142.103.187:995
78.160.146.127:443
84.35.26.14:995
12.172.173.82:20
124.149.143.189:2222
70.160.67.203:443
186.64.67.30:443
103.123.223.133:443
188.28.19.84:443
174.58.146.57:443
94.207.104.225:443
86.97.55.89:2222
69.123.4.221:2222
Targets
-
-
Target
flbfu6.msi
-
Size
504KB
-
MD5
101aefb58c77d2fe5b6a7bc1e13ac9d3
-
SHA1
13cbe917288c2f42925b1773838ce2df0a142385
-
SHA256
a5dd3acf7e57cc25ab353d80584c4cf8e148b3504f498e243c4be48f9fc1f064
-
SHA512
f745fe34b525ffbd04768bde8c22a0180435b0a406c8eb9196a8bd39029f46df2a1d356797d77490236bd07086853a254bc156982c8da349486b5591d660d9f5
-
SSDEEP
6144:nESkw7402pCiyBH6DlIxtWb9jOyHLmsjzcGet8Rghs0O892YptgrGzjkacDO+cDb:zkdiMHHLmKzQ8tfacDO+wVydjv3k
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-